Docker operations pack

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

sudo emisar pack install docker --hash sha256:a3564ddfd00a9802e3ac6ba7e9068d80029aeb903e43417eeb995624299c38f5

• docker.compose_logs exec low

  docker compose logs (last N lines)

  Returns the last N lines of logs for one service in a compose project. Read-only.

  View source on GitHub
• docker.compose_ps exec low

  docker compose ps -a

  Lists services in a compose project (running + stopped). The compose-file path is required and pattern-restricted. Read-only.

  View source on GitHub
• docker.compose_restart exec high

  docker compose restart (one service)

  Restarts ONE service in a compose project. SIGTERM with the configured stop_grace_period, then SIGKILL, then start. In-flight requests are dropped.

  View source on GitHub
• docker.container_top exec low

  docker top (processes inside a container)

  Lists processes running inside one container (via `docker top`). Use when the container's CPU is hot but you don't know which child process is the offender. Read-only.

  View source on GitHub
• docker.events_tail script low

  docker events — lifecycle + failures (bounded window)

  Replay docker daemon events from the last N minutes, focused on container lifecycle and failures (create, start, restart, stop, die, kill, oom, destroy, health_status) — the "why did the container restart / OOM / go unhealthy?" read. Routine health-check exec_* chatter is excluded by default so the real signal is not drowned out; set include_exec=true to add exec_create/exec_start/ exec_die. Read-only.

  View source on GitHub
• docker.image_history exec low

  docker history

  Returns the layer-by-layer build history of one image — useful for tracing "where did this 2 GB layer come from?" Read-only.

  View source on GitHub
• docker.image_inspect exec low

  docker image inspect

  Returns the full JSON inspect document for one image — labels, config, exposed ports, build history root, and the image's baked-in env. Image env is build-time config, but a badly-built image can bake a secret in; the runner's redaction is a pattern-bound backstop. Read-only.

  View source on GitHub
• docker.images exec low

  docker images

  Lists images on the host. Use to verify expected tags are present before a deploy or to find old images consuming disk. Read-only.

  View source on GitHub
• docker.info exec low

  docker info

  `docker info` — daemon version, storage driver, total containers/images, host resources. Read-only.

  View source on GitHub
• docker.inspect exec medium

  docker inspect (one container)

  Returns the full JSON inspect document for one container — state, exit code, restart count, mounts, network config, labels, and the container's env. The env commonly carries injected secrets (DB URLs, API keys, values passed with -e), so this is approval-gated; the runner's redaction is a fail-closed backstop, not a guarantee — it is pattern-bound and can miss a bespoke secret. Container name is pattern-restricted. Read-only.

  View source on GitHub
• docker.kill exec high

  docker kill (signal)

  Sends a Unix signal to one container's main process. Default is SIGKILL — immediate, no graceful drain. Specify `signal:` for SIGTERM (graceful) or SIGHUP (reload).

  View source on GitHub
• docker.logs exec low

  docker logs (last N lines)

  Returns the last N log lines for one container. Container name is pattern-restricted to alnum + "_-.". Read-only. Output passes through the runner's redaction pipeline.

  View source on GitHub
• docker.network_inspect exec low

  docker network inspect

  Returns the JSON inspect document for one network — subnet, gateway, containers attached, driver options. Read-only.

  View source on GitHub
• docker.network_ls exec low

  docker network ls

  Lists all docker networks with driver + scope. Read-only.

  View source on GitHub
• docker.ps exec low

  docker ps -a

  Lists all containers (running + stopped). Returns id, image, status, ports, names. Always includes stopped containers — for triage you almost always want to see the dead ones too. Read-only.

  View source on GitHub
• docker.pull_image exec medium

  docker pull

  Pulls one image from its configured registry. Network + disk intensive; image-ref restricted to safe characters. Idempotent — re-pulling an existing tag re-checks the digest.

  View source on GitHub
• docker.restart exec high

  docker restart (one container)

  Restarts one container. Sends SIGTERM, waits for the configured stop-timeout, then SIGKILL, then re-starts. In-flight requests are dropped; the container's restart policy still applies after this call. Container name is pattern-restricted.

  View source on GitHub
• docker.stats exec low

  docker stats (one shot)

  Captures one frame of `docker stats` (CPU%, mem usage/limit, net I/O, block I/O, PIDs) for every running container. Read-only.

  View source on GitHub
• docker.stop exec high

  docker stop (one container)

  Stops one container — SIGTERM, then SIGKILL after the configured timeout. Container stays around (for inspection/restart). Use `docker.kill` for immediate SIGKILL.

  View source on GitHub
• docker.system_df exec low

  docker system df

  Reports disk usage by docker (images, containers, volumes, build cache). Use to plan a prune. Read-only.

  View source on GitHub
• docker.system_prune exec high

  docker system prune

  Removes stopped containers, dangling images, and unused networks. Does NOT remove unused volumes (intentional — volume data is the riskiest thing to delete). Run `docker.system_df` first to scope what will be freed. Irreversible.

  View source on GitHub
• docker.version exec low

  docker version

  Returns client + server version, API version, build info. Read-only.

  View source on GitHub
• docker.volume_inspect exec low

  docker volume inspect

  Returns the JSON inspect document for one volume — driver, mountpoint, labels. Read-only.

  View source on GitHub
• docker.volume_ls exec low

  docker volume ls

  Lists all named docker volumes. Read-only.

  View source on GitHub
• docker.volume_prune exec critical

  docker volume prune (DESTRUCTIVE)

  Removes every volume not attached to a container. **Permanently deletes the data on them.** Use only on caches and dev hosts. Pair with `docker.volume_ls` first to confirm what's loose.

  View source on GitHub